HeNet: A Deep Learning Approach on Intel® Processor Trace for Effective Exploit Detection

This paper presents HeNet, a hierarchical ensemble neural network, applied to classify hardware-generated control flow traces for malware detection. Deep learning-based malware detection has so far focused on analyzing executable files and runtime API calls. Static code analysis approaches face challenges due to obfuscated code and adversarial perturbations. Behavioral data collected during execution is more difficult to obfuscate but recent research has shown successful attacks against API call based malware classifiers. We investigate control flow based characterization of a program execution to build robust deep learning malware classifiers. HeNet consists of a low-level behavior model and a top-level ensemble model. The low-level model is a per-application behavior model, trained via transfer learning on a time-series of images generated from control flow trace of an execution. We use IntelR Processor Trace enabled processor for low overhead execution tracing and design a lightweight image conversion and segmentation of the control flow trace. The top-level ensemble model aggregates the behavior classification of all the trace segments and detects an attack. The use of hardware trace adds portability to our system and the use of deep learning eliminates the manual effort of feature engineering. We evaluate HeNet against real-world exploitations of PDF readers. HeNet achieves 100% accuracy and 0% false positive on test set, and higher classification accuracy compared to classical machine learning algorithms.


Li Chen

Research Scientist and Data Scientist, Security and Privacy Research Lab

View authors bio

Salmin Sultana

Ravi Sahita

Related Content

Robust Vertex Classification

For random graphs distributed according to stochastic blockmodels, a special case of latent position graphs, adjacency spectral embedding followed by...

View publication

Learning Visual Knowledge Memory Networks for Visual Question...

Visual question answering (VQA) requires joint comprehension of images and natural language questions, where many questions can't be directly or...

View publication

Explicit Loss-Error-Aware Quantization for Deep Neural Networks

Benefiting from tens of millions of hierarchically stacked learnable parameters, Deep Neural Networks (DNNs) have demonstrated overwhelming accuracy on a...

View publication

Persistent Homology for Virtual Screening

Finding new medicines is one of the most important tasks of pharmaceutical companies. One of the best approaches to finding...

View publication

Stay Connected

Keep tabs on all the latest news with our monthly newsletter.